Lookout CASB pricing in 2026 lands at $5-$10 per user per month for the CASB module, with mobile CASB included for endpoint-managed mobile devices. Lookout is the right choice for organizations that want combined mobile threat defense and CASB on the same agent, particularly for BYOD-heavy environments. The platform ships 25,000+ SaaS app risk profiles and integrates with Lookout Mobile Endpoint Security for unified mobile-cloud posture (Lookout CASB, September 2026).
CASB per-user pricing comparison.
| Vendor | Entry tier | Full SSE bundle | Notable feature |
|---|
| Microsoft MCAS | $5-$8 per user per month (standalone) | Free in E5 ($57/user/mo) | 31,000+ SaaS risk profiles |
| Netskope CASB | $5-$8 per user per month (Standard) | $8-$15 per user per month | 3,000+ deep API integrations |
| Palo Alto Prisma SaaS | $4 per user per month (Standard API) | $10 per user per month (Premium) | NGFW policy integration |
| Bitglass / Forcepoint | Custom quote, typically $8-$12 per user per month | Custom quote | Agentless mobile CASB |
| Lookout CASB | $5-$10 per user per month | $10-$15 per user per month | Mobile + CASB on same agent |
Source: Microsoft, Netskope, Palo Alto, Forcepoint, Lookout pricing pages, retrieved September 14, 2026.
For Microsoft-heavy environments, MCAS wins on cost and integration. For multi-cloud SaaS estates, Netskope wins on coverage and DLP accuracy. For Palo Alto NGFW-centric networks, Prisma SaaS wins on policy integration. For mobile-CASB convergence, Lookout or Bitglass are the right choices.
API-mode vs forward-proxy CASB coverage.
API-mode CASB (Microsoft Defender for Cloud Apps, Netskope API, Palo Alto Prisma SaaS API) connects directly to the SaaS provider's API to read and modify data after the fact - typically used for shadow-IT discovery, data-at-rest scanning, and policy enforcement on stored data. API-mode typically covers 90-100% of Microsoft 365, 70-90% of Google Workspace, and 50-80% of Salesforce, ServiceNow, Workday, Box, and Slack.
Forward-proxy CASB (Netskope Forward Proxy, Bitglass, Prisma SaaS Advanced) intercepts user traffic in real time and inspects it inline - typically used for data-in-motion DLP, malware detection, and session controls. Forward-proxy supports any HTTPS-based SaaS app and is the right choice for inline DLP on Microsoft 365, Salesforce, Workday, and other regulated SaaS workloads.
Most enterprises run a hybrid in 2026 - API-mode for shadow-IT discovery and stored data scanning, plus forward-proxy for inline SaaS traffic - with combined per-user cost of $8-$15. API-mode alone is typically $3-$8 per user per month; forward-proxy alone is typically $5-$12 per user per month (Gartner CASB Magic Quadrant, September 2026).
DLP accuracy and coverage comparison.
DLP accuracy is the single largest CASB differentiator in 2026. Netskope leads the industry with 95-99% accuracy on regulated data patterns (PII, PHI, PCI, GDPR, HIPAA, ITAR) thanks to ML-based fingerprinting and proximity matching; Microsoft MCAS ships 90-95% accuracy with strong Microsoft Purview integration; Palo Alto Prisma SaaS ships 90-95% accuracy with NGFW-shared policy; Bitglass ships 90-96% accuracy with 7,500+ classifiers.
For organizations with significant PII, PHI, or PCI workloads in SaaS, Netskope's DLP accuracy advantage typically reduces false-positive SOC alerts by 30-50% and reduces compliance audit findings by 20-30%. The 1-3 percentage point accuracy delta translates into meaningful operational savings at 5,000+ user scale.
DLP coverage in 2026 typically includes regex patterns for SSN, credit card, passport, driver's license, bank account, ITAR, HIPAA PHI, GDPR PII, PCI cardholder data, plus fingerprinting for source code (GitHub, GitLab), CAD files (AutoCAD, SolidWorks), and structured data exports (Excel, CSV, Parquet).
3-year TCO comparison at 1,000 users.
| Cost line | Microsoft MCAS (E5) | Netskope SSE | Prisma SaaS Premium |
|---|
| Per-user license (year 1) | $0 incremental in E5 | $120,000 | $120,000 |
| Per-user license (3 years) | $0 incremental | $360,000 | $360,000 |
| Professional services | $20,000-$50,000 | $50,000-$150,000 | $30,000-$80,000 |
| Integration with SOC tools | $10,000-$30,000 | $20,000-$50,000 | $20,000-$50,000 |
| 3-year TCO | $30,000-$80,000 | $430,000-$560,000 | $410,000-$490,000 |
Source: Vendor pricing plus ESG and IDC 2026 CASB TCO models, retrieved September 14, 2026.
Microsoft MCAS bundled in E5 is by far the cheapest path to enterprise CASB in 2026, but only for organizations already paying for E5 and primarily running Microsoft SaaS. For multi-cloud SaaS estates, Netskope or Palo Alto Prisma SaaS are the right choices despite the 5-10x license cost premium.
Bottom line for 2026 buyers.
CASB cost 2026 lands at $4-$15 per user per month depending on vendor and scope, with Microsoft MCAS as the cheapest option (free in E5), Netskope as the premium multi-cloud SaaS leader ($8-$15), and Palo Alto Prisma SaaS as the NGFW-integrated choice ($4-$10). Most enterprises run a hybrid model - MCAS for Microsoft SaaS plus a second CASB for non-Microsoft coverage - with combined per-user cost of $10-$20.
Alternatives to consider
If neither contender in this comparison fits, these adjacent options are worth a look:
- Premium tier (when both candidates are mid-tier and you want the flagship experience).
- Budget tier (when you'd use the cheapest viable alternative anyway).
- Niche alternative (when one specific dimension — battery, ecosystem, weight — dominates your decision).
FAQs
What is the difference between CASB and SWG?
CASB (Cloud Access Security Broker) focuses on SaaS app risk, shadow IT discovery, and SaaS-specific DLP via API or forward-proxy. SWG (Secure Web Gateway) focuses on general HTTPS inspection for any internet destination. Most enterprises in 2026 buy both because SWG handles generic internet traffic and CASB handles SaaS-specific risk. Vendors like Zscaler, Netskope, and Palo Alto bundle CASB and SWG in their SSE platforms.
Does CASB work for non-Microsoft SaaS like Salesforce?
Yes - Netskope, Palo Alto Prisma SaaS, Bitglass, and Lookout all ship deep Salesforce integrations in 2026, with API-mode coverage for Account, Contact, Opportunity, Lead, Case, and custom objects. The integration typically takes 4-8 weeks of professional services work and ships DLP for Salesforce reports, exports, and email templates.
Does CASB replace DLP?
No - CASB focuses on SaaS-specific DLP (Salesforce, Microsoft 365, Google Workspace, Box, Slack) via API-mode and forward-proxy, but it does not replace endpoint DLP or network DLP. A complete DLP strategy in 2026 typically includes endpoint DLP (Symantec, Microsoft Purview Endpoint), network DLP (Netskope, Zscaler), and CASB DLP (Microsoft MCAS, Netskope CASB) - with combined per-user cost of $15-$30.
Does Microsoft MCAS include SaaS DLP?
Yes - Microsoft MCAS integrates with Microsoft Purview DLP in 2026, providing unified DLP policy across Microsoft 365, Microsoft Defender for Endpoint, and Microsoft Defender for Cloud Apps. Purview DLP ships 300+ built-in sensitive info types (PII, PHI, PCI, GDPR, HIPAA, ITAR) and supports custom fingerprinting and ML-based classification. Purview DLP is bundled in Microsoft 365 E5.
Can CASB block screenshots and screen sharing?
Yes - Netskope, Bitglass, and Palo Alto Prisma SaaS ship session controls in 2026 that can block screenshots, screen sharing, copy-paste, download, and print for specific SaaS apps. Microsoft MCAS ships similar session controls via Defender for Cloud Apps Conditional Access App Control. These controls are typically used for regulated workloads (financial data, healthcare records, source code) and require per-user licensing on the advanced CASB tiers.
Does CASB work for AI applications like ChatGPT Enterprise?
Yes - Netskope, Microsoft MCAS, Palo Alto Prisma SaaS, and Lookout all ship ChatGPT, Microsoft Copilot, Google Gemini, and Claude Enterprise coverage in 2026 via API-mode and forward-proxy. The CASB can enforce DLP on prompts and responses, block sensitive data from being uploaded to AI tools, and log AI usage for compliance. AI governance is one of the fastest-growing CASB use cases in 2026, with 40-50% of enterprises adding AI-specific CASB policies (Netskope, Microsoft AI Governance, September 2026).
Fazlur Rahman
